Who is responsible

LŪDUM, located at Presidente Plaza, 3rd floor, Av. de la Revolución, San Salvador, El Salvador. Data protection officer: Iván López Márquez. For any data matter, write to hola@ludumsv.com or on WhatsApp at +503 7642 2690.

What data we collect

RED LŪDUM account: name, email address, phone (WhatsApp, optional), your Instagram username (optional) and your consents. Purchases: what you buy, how much you pay, the order number, whether you pick it up or we deliver it and, if you arrived through one of our links (from Instagram, for example), which post you came from and, if we sent you that link by direct message, the number of that conversation; payment is processed by n1co and we never store card details. Deliveries: if you ask for home delivery, the full name of the recipient, a contact number, the exact address and a landmark; if you tick «Save these details to my account», they are kept for your next purchase. Lab and LŪDUM Cloud: your rolls (film, format, date) and their scans, which we keep so you can view and download them from your account; if you share a roll with a link, whoever has it can see those photos. Reviews: if you review a product, we keep your stars, the title, the text, the photos you upload (your browser shrinks them before sending them and removes the camera and location data), the language you wrote it in and whether you bought it on the website («Verified purchase»). Reviews are public: anyone visiting the shop sees your first name with the initial of your last name, the stars, the text and the photos. LŪDUM Members: if you become a member, your tier, how long the membership is paid for, how you paid for it (on the website, at LŪDUM or as a gift), your member number (and your founder number, if you have one) and the activity on your included rolls or, for earlier memberships, on your credit (each load, each use with its reference and what expired, with its date); what you use at LŪDUM is recorded by the team when you show your card. While your membership is active, your first name with the initial of your last name appears on the wall of the people who keep LŪDUM going, which is public. Gifts: if you give a gift card or a membership, the name and email of the person receiving it and your message, only to deliver it. Patrons: if you contribute to the LŪDUM Fund, the amount and the date, as with any order, and, if you asked to appear on the patrons’ wall, the name you wrote. That name is public: anyone who visits the website can see it. Newsletter: your email, only if you ticked that you want to receive it. Photos: images from your rolls are only published if you ticked the box and then approve each photo (see «Your photos on the website»). Messages: if you write to us on Instagram or WhatsApp, or comment a keyword on one of our posts, your name, your username (or your number, on WhatsApp) and your profile photo as they appear in the app, your messages, which post or keyword you came from, a short summary of the conversation (what you’re looking for, what we replied and what’s still pending) and tags such as «received the link», «passed to the team» or «not interested» (see «When you write to us»). Archivo abierto: if you send us old photos of your family, the photos and what you tell us about them, such as the year, the place, who appears in them and who took them (see «Your family’s photos»). Technical: the server logs the IP address of each visit for security for a short time. Measurement: we count visits with Vercel Web Analytics, without cookies and without identifying anyone: which pages are viewed, from which country and on what kind of device, plus general actions such as “add to cart”. We don’t collect or ask for sensitive data.

On what basis we do it

With your consent, which you give when you create your account (on the website or at the LŪDUM counter), tick the newsletter, tick the photos box, publish a review, send photos to the Selection or to Archivo abierto or ask to appear on the patrons’ wall, and which you can withdraw whenever you like. And to do what you asked us to: answer your messages, deliver a purchase, develop your rolls or handle a repair. What the law of El Salvador requires (invoices, for example) we keep because the law says so.

What we use it for

To answer your messages, deliver what you bought, develop and return your rolls and scans, apply your 10% or your membership and let you know the status of your orders. With the summary of the conversation we don’t ask you the same thing twice, and with the origin of a purchase we know which posts work and, if we sent you the link by direct message, we can follow up with you in that same conversation. With your consent, also: to tell you about drops, the magazine and the archive (newsletter), to show your photos on the website (photos), to publish your reviews in the shop so other people know what a product is like, to show your name on the patrons’ wall and to get to know and, with your permission, publish your family’s photos (Archivo abierto). We don’t sell or rent your data, or build advertising profiles.

Your photos on the website

If you ticked «I’d like my photos developed by LŪDUM to be able to appear on the website» (when creating your account, in your account or in your lab order), that only means you’re interested: before publishing any photo of yours we show it to you and you tell us yes or no, photo by photo. We credit you however you like (name or Instagram) and you can ask us to remove it whenever you want. Your photos remain yours: we don’t sell them, we don’t give them to third parties and we don’t use them in paid advertising without asking you separately. Photos you send to the LŪDUM Selection from your account are separate: by sending them you allow us to publish the ones the team picks, with your name, on @ludumsv, on the website and in the Magazine.

When you write to us

When you write to us on Instagram or WhatsApp, an automatic assistant may answer you first: Claude, by Anthropic, which works inside Manychat, the platform we use to handle messages. The assistant reads your message and what we already know from the conversation, answers with LŪDUM’s information and, when needed, passes the conversation to a person on the team. It doesn’t make decisions about you: it doesn’t confirm payments, orders or deliveries, and it never asks for card details or passwords. If you’d rather talk to a person, just say so at any time. If you tell us you’re not interested, we note it and don’t write to you again, unless you write to us.

Your family’s photos

If you send us old photos of your family for Archivo abierto, we keep them with what you tell us about them, to get to know them and choose which ones to show in Archivo, LŪDUM’s series on the visual memory of El Salvador. Sending them doesn’t authorize us to publish them: if we choose one, we write to you first to ask your permission, and it is always credited to your family. We don’t sell them or pass them on to anyone, and you can ask us to delete them, or to take down one that’s already published, whenever you like.

Who we share it with

Only with the services that make LŪDUM work, each with what it needs for its part: n1co (payments; with the order it also receives the delivery method and, for deliveries, the delivery details), Vercel (the website), Supabase (the accounts database), Resend (emails), Cloudflare (stores LŪDUM Cloud scans and review photos), Pixieset (scan delivery), WhatsApp (notifications), Manychat (direct messages) and Anthropic (Claude, the automatic assistant that prepares the replies; its terms don’t allow it to use your messages to train its models). Some store data on servers outside El Salvador, mainly in the United States; we do so under contracts that require them to take the same care we do, and with your consent, which you give when creating your account, or, for your messages, because it’s needed to answer you. Messages also go through Instagram and WhatsApp, which belong to Meta and handle them under their own privacy policy. If you ask for delivery, whoever carries the package (our team or a courier) receives your name, number, address and landmark, only for that delivery. We never share your data with anyone else, unless an authority requires it by law.

How long we keep it

Your account, while it’s active or until you delete it. Your scans, 90 days online from when they’re ready and a copy for 12 more months; we email you before each step and, once that period is over, we delete it. With LŪDUM Cloud (or Members Plus and Studio), they stay online while the plan is active. Purchases and invoices, with their delivery details, for as long as the law requires. Delivery details saved to your account, until you forget them from your account or delete it. Your reviews, until you delete them from the product page or delete your account; we may hide or delete a review that isn’t about the product or doesn’t respect other people. Your membership and the activity on your rolls or your credit, for as long as you have the account; since they are payments, we keep them for as long as the law requires. Your patron contributions, like any payment, for as long as the law requires; your name on the wall, until you ask us to remove it or delete your account. Your messages and what we note from the conversation, up to 2 years after your last message or until you ask us to delete them; the conversation also remains on Instagram or WhatsApp, under Meta’s rules. Archivo abierto photos, until you ask us to delete them. The newsletter, until you unsubscribe (there’s a link in every email). Sign-in links last 30 minutes and sessions, 30 days.

Your rights

You can ask to see, correct, delete or restrict the use of your data, object to a use, take a copy and withdraw a consent, whenever you like and at no cost. Write to hola@ludumsv.com or delete your account from the website. If it’s about your messages or Archivo abierto photos, you can also ask us in the same conversation. We reply within 20 business days at most; we apply the withdrawal of a consent within 5 business days. If you delete your account, we also close your orders, your links and your published photos, remove your name from the patrons’ wall and delete your reviews (with their photos) and your Cloud scans. If we don’t handle your request properly, you can turn to the Agencia de Ciberseguridad del Estado (El Salvador’s state cybersecurity agency).

Cookies and storage

We use a single cookie, ludum_s, to keep you signed in to your account. The cart, your code, your early access and, if you arrived through one of our links, where you came from are stored in your browser’s local storage, not on our servers; the delivery details you type in the cart, only while the tab is open. Where you came from is kept for 30 days (or until your payment is confirmed) and only reaches us if you buy, with your order. We don’t use tracking or advertising cookies. The n1co payment page uses its own cookies, with its own notice.

Minors

The RED LŪDUM is for people over 18. If you’re a minor, ask your mother, father or guardian to create the account and write to us.

Security

Data travels encrypted, service keys live outside the page, sign-in links are stored encrypted and only the team handling your order sees what it needs. If a security incident affecting your data ever happened, we would notify you within 72 hours at most, as we would the authorities.

Changes

If we change this notice, we publish it here with the date and, if the change affects you, we let you know by email. Version 10 · October 28, 2026.